1. IDENTITY AND ADDRESS OF THE RESPONSIBLE ENTITY.
This Privacy Notice (hereinafter, the “Notice”) sets forth all the terms and conditions under which EXPO PACK MÉXICO, S.A. DE C.V., known commercially as “EXPO PACK,” as referred to hereinafter, whose address for service of process and receipt of notifications, as well as for any other communication pursuant to this Notice, is located at Homero No. 418, Third Floor, Colonia Chapultepec Morales, Miguel Hidalgo District, ZIP Code 11570, Mexico City, in its capacity as the Data Controller, will process the personal data concerning you as the data subject, for the purpose of protecting your privacy and your right to informational self-determination, in accordance with the provisions of the Federal Law on the Protection of Personal Data Held by Private Parties, its Regulations, and other related legislation (collectively, the “Data Protection Legislation”).
2. PERSONAL INFORMATION WE COLLECT AND PROCESS.
EXPO PACK collects and processes the personal data listed below, depending on your relationship with EXPO PACK:
a. If they are your guest, prospective client, client, and/or speaker:
i. Identification and contact information.
ii. Video and/or audio recordings.
iii. Calls to customer service, emails, and conversations.
iv. Online identifiers.
v. Financial and economic data.
vi. Employment and academic information.
vii. Demographic information.
viii. Interests, experiences, and responsibilities.
b. If it is your supplier:
i. Identification and contact information.
ii. Video and/or audio recordings.
iii. Financial and economic data.
iv. Employment information.
If you have provided EXPO PACK with a third party’s personal data, you warrant that you have their authorization and/or consent to provide us with such data for processing in accordance with the purposes of this Policy, and you are responsible for informing that person (i) of the terms and purposes for which EXPO PACK will contact them; and/or (ii) as applicable, the terms of this Policy and the processing of your personal data in accordance with this Policy.
3. PURPOSES
At EXPO PACK, we process your personal data to carry out the primary activities and procedures aimed at fulfilling the obligations arising from and related to any commercial and/or legal relationship we establish with you, which are:
a. For guests, prospective clients, clients, and speakers:
i. Register in our databases and directories of guests, visitors, prospects, customers, and/or speakers.
ii. Manage and administer events, including payments, technical support, and operations.
iii. Monitor and control their access to events.
iv. Manage security at EXPO PACK events, including video recording of activities and handling security incidents.
v. Help our speakers send invitations to your guests for the EXPO PACK events.
vi. Manage payment for services and collection activities.
vii. Manage usernames and passwords to verify the identities of speakers and VIP guests, so they can use the online services and your tools, including the Speaker’s Manual.
viii. to enable and maintain the management, administration, and security of your personal data and the procedures related to those activities.
ix. To provide information, communications, and notifications regarding our services.
x. Implement the strategies and market segmentation necessary for the provision of our services.
xi. Provide advice, clarifications, and customer service, and retain the corresponding conversations, calls, and emails for record-keeping and follow-up purposes.
xii. Carry out activities and actions—whether preventive and/or corrective—necessary to comply with internal protocols and plans and/or those required by law regarding the response to, prevention, and mitigation of suspected and/or confirmed cases of infectious diseases, as well as other health contingency plans and protocols, or to promote health within the Data Controller’s facilities, including health monitoring, sending notifications regarding cases of such diseases on the Data Controller’s premises, creating records of individuals with such diseases, those exhibiting symptoms of such diseases, or those vulnerable to infection, and determining applicable measures.
xiii. To respond to legal requests from competent national and international authorities and to comply with the obligations arising from the legal relationship between you and the Data Controller.
xiv. To comply with the applicable national or international legal provisions and obligations applicable to the Data Controller, its subsidiaries, and/or affiliates, as well as to manage any legal proceedings involving them.
xv. Carry out the transfers referred to in Section 4 of this Policy.
xvi. carry out procedures related to corporate restructurings of the Controller, including mergers, consolidations, sales, liquidations, or transfers of assets.
xvii. Supplementary activities necessary to achieve the foregoing purposes.
b. For suppliers:
i. Grant access to EXPO PACK facilities and events.
ii. Manage our suppliers' information to keep our databases up to date.
iii. Manage our relationships with suppliers during the selection and hiring process.
iv. Management of purchase order and/or contract requests.
v. Prove your identity and verify the information you provide to us.
vi. Upload the files and create your profile.
vii. Manage the payment of your bills and/or the collection of fees.
viii. to enable the management, administration, and security of your personal data and the procedures related to those activities.
ix. Monitor and control physical and logical access to EXPO PACK’s technological and security resources, including video recording of activities.
x. Carry out activities and actions—whether preventive and/or corrective—necessary to comply with internal protocols and plans and/or those required by law regarding the response to, prevention, and mitigation of suspected and/or confirmed cases of infectious diseases, as well as other health contingency plans and protocols, or to safeguard health within the Data Controller’s facilities and events, including monitoring their health, sending notifications regarding cases of such diseases at the Data Controller’s facilities and events, creating records of individuals with such diseases, those exhibiting symptoms of such diseases, or those vulnerable to infection, and determining applicable measures.
xi. To respond to legal requests from competent national and international authorities and to comply with the obligations arising from the legal relationship between you and the Data Controller.
xii. Comply with the applicable national and international legal provisions and obligations applicable to the Data Controller, its subsidiaries, and/or affiliates, as well as manage any legal proceedings involving them.
xiii. Make the transfers described in Section 4 of this Policy.
xiv. Carry out procedures related to corporate restructurings of the Controller, including mergers, consolidations, sales, liquidations, or transfers of assets.
xv. Supplementary activities necessary to achieve the foregoing purposes.
In addition, we will process your personal data for other secondary purposes that do not arise from or are necessary for the business and/or legal relationship we establish with you, namely:
a. For guests, prospective clients, clients, and speakers:
i. To send you newsletters and information via instant messaging, print, and electronic media regarding EXPO PACK events, invitations, promotions, services, and products, as well as other events in Mexico and/or abroad organized by suppliers, speakers, and/or sponsors that we believe may be of interest to you.
ii. To send you communications for marketing, advertising, or business development purposes related to EXPO PACK events, whether via print or electronic media.
iii. To conduct market research and for statistical purposes.
b. For Suppliers (individuals):
i. Conduct comparative market studies.
ii. To manage the sending of communications containing advertising, notices, messages, news, and invitations to events and meetings, whether via print, electronic, telephone, and/or in-person means, for advertising, promotional, business development, or marketing purposes.
If you do not wish for your personal data to be processed for these secondary purposes, you may send an email to protecciondedatos@expopack.com.mx, following the procedure outlined in Section 5 of this Policy.
4. TRANSFER OF DATA TO THIRD PARTIES.
Based on the foregoing, EXPO PACK may transfer your personal data within the country or abroad, in accordance with the following:
a. To government authorities, agencies, or entities, in compliance with or in connection with EXPO PACK’s obligations under applicable law, its subsidiaries and/or affiliates, as well as in compliance with any requests made to them;
b. To government authorities, agencies, or entities, as well as notaries and public brokers, when the disclosure is officially required and/or necessary for the recognition, exercise, or defense of a right of EXPO PACK in legal proceedings;
c. To third-party acquirers resulting from a corporate restructuring of EXPO PACK, including a merger, consolidation, sale, liquidation, or transfer of assets, when such transfer is necessary to maintain or fulfill the relationship between you and EXPO PACK;
d. To EXPO PACK’s consultants, vendors, and suppliers, when the transfer is necessary to maintain or fulfill the relationship between you and EXPO PACK; and
e. To parent companies, subsidiaries, or entities under common control with EXPO PACK that operate under the same internal processes and policies as EXPO PACK, for the purposes of centralized information storage, the provision of services, administrative, analytical, and statistical purposes, and customer registration, as well as any other administrative process of the EXPO PACK business group;
f. Based on the other grounds established in the Data Protection Law that do not require your consent; and
g. To third parties—whether domestic or foreign—in the packaging, processing, hospitality, food, services, and conference and exhibition industries, for the purposes of marketing, advertising, promotion, and business development.
Except for those mentioned in section g., these disclosures do not require your consent. If you do not object to such a disclosure—which you may do at any time by sending an email to protecciondedatos@expopack.com.mx in accordance with the provisions of section 5 below—we will assume that you have given your consent.
5. PROCEDURE FOR EXERCISING DATA SUBJECT RIGHTS AND WITHDRAWING CONSENT.
At any time, you have the right to (i) access, correct, and delete your personal data (hereinafter, the “ARCO RIGHTS”), (ii) revoke your consent regarding the processing of your personal data in accordance with the law; and (iii) object to the processing of your personal data for the aforementioned secondary and ancillary purposes. You may exercise these rights directly or through your legal representative by sending an email to protecciondedatos@expopack.com.mx with the subject line “Exercise of Data Protection Rights,” including the information and documentation detailed below:
a. First and last name;
b. Email address or mailing address to which we can send you a response regarding your request;
c. Official identification:
d. If applicable, the full name of your legal representative, a document proving your identity and that of your representative (valid official photo ID), and a copy of the power of attorney—whether notarized or in the form of a letter of authorization signed by two witnesses—proving that said legal representative is authorized to act on your behalf, in accordance with the terms set forth in the Data Protection Law.
e. A right you would like to exercise and why;
f. A clear and precise description of the personal data with respect to which you wish to exercise any of your rights;
g. Any other information or document that helps locate your personal data; and
h. If you exercise your right to rectification, documentation proving the modification of your data.
Once you have sent the email to exercise your rights, within a maximum of 20 (twenty) business days from the time your request was received, you will receive EXPO PACK’s decision so that, if applicable, it may take effect within 15 (fifteen) business days following the date on which you are notified of the response. In all cases, EXPO PACK’s response will be delivered to you via the same method you used to submit your request. These deadlines may be extended once for an equal period, provided the circumstances of the case warrant it, as provided for in the Data Protection Law.
The provision of personal data will be free of charge; you will only be required to cover reasonable shipping costs or the cost of reproducing the information in copies or other formats. If you submit a repeat request within 12 (twelve) months, you will be required to cover the corresponding costs in accordance with data protection laws, unless there have been material changes to the privacy policy that warrant new inquiries.
For the receipt, registration, handling, and response to requests regarding the exercise of your ARCO rights and other rights provided for in data protection legislation, we have made a Privacy Officer available to you, whom you may contact at the offices listed in Section 6 of this Policy.
If the information provided in your request is incorrect or insufficient, or if the required supporting documents are not attached, we may request that you provide the necessary information or documents to process your request within 5 (five) business days of receiving it. You will have 10 (ten) business days to comply with our request, counted from the day following receipt of the request. If you do not respond within that period, the application will be deemed not to have been submitted.
